CVE-2017-9077: High severity Linux Linux kernel vulnerability

Q: What is CVE-2017-9077?

CVE-2017-9077 is a vulnerability in the Linux kernel's tcp_v6_syn_recv_sock function that can lead to denial of service or other unspecified impacts due to mishandled inheritance.

Q: What is the impact of CVE-2017-9077?

The impact of CVE-2017-9077 includes potential denial of service attacks that local users could exploit through crafted system calls.

Q: How do I fix CVE-2017-9077?

To fix CVE-2017-9077, upgrade to kernel versions 5.10.223-1, 5.10.226-1, 6.1.123-1, or later versions.

Q: Which Linux kernel versions are affected by CVE-2017-9077?

Linux kernel versions up to 4.4.71 and various versions between 3.2.89 and 4.11.4 are affected by CVE-2017-9077.

Q: Is CVE-2017-9077 specific to any operating system?

Yes, CVE-2017-9077 primarily affects the Linux operating system, including distributions like Debian and Android.

Published May 19, 2017

Updated

Last updated 29 November 2024

Other sources

The tcpv6synrecvsock function in net/ipv6/tcpipv6.c in the Linux kernel mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.

Upstream patch:

https://github.com/torvalds/linux/commit/83eaddab4378db256d00d295bda6ca997cd13a52

References:

https://patchwork.ozlabs.org/patch/760370/

— Red Hat

The tcpv6synrecvsock function in net/ipv6/tcpipv6.c in the Linux kernel through 4.11.1 mishandles inheritance, which allows local users to cause a denial of service or possibly have unspecified other impact via crafted system calls, a related issue to CVE-2017-8890.

— Launchpad

Affected Software

29 affected componentsFixes available

Linux Linux kernel<3.2.89

Linux Linux kernel>=3.3<3.16.44

Linux Linux kernel>=3.17<3.18.84

Linux Linux kernel>=3.19<4.4.71

Linux Linux kernel>=4.5<4.9.31

Linux Linux kernel>=4.10<4.11.4

debian/linux

5.10.223-15.10.234-16.1.129-16.1.128-16.12.21-16.12.22-1

Google Android

ubuntu/linux<3.13.0-123.172

3.13.0-123.172

ubuntu/linux-lts-xenial<4.4.0-83.106~14.04.1

4.4.0-83.106~14.04.1

ubuntu/linux<4.4.0-83.106

4.4.0-83.106

ubuntu/linux-aws<4.4.0-1022.31

4.4.0-1022.31

ubuntu/linux-gke<4.4.0-1018.18

4.4.0-1018.18

ubuntu/linux-hwe<4.10.0-32.36~16.04.1

4.10.0-32.36~16.04.1

ubuntu/linux-raspi2<4.4.0-1061.69

4.4.0-1061.69

ubuntu/linux-snapdragon<4.4.0-1063.68

4.4.0-1063.68

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15*

ubuntu/linux-gke*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-azure-6.11*

ubuntu/linux-gcp-6.11*

ubuntu/linux-hwe-6.11*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-raspi-realtime*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.128-1Fixed in 6.12.21-1Fixed in 6.12.22-1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 3.13.0-123.172
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-83.106~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-83.106
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1022.31
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 4.4.0-1018.18
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.10.0-32.36~16.04.1
Upgrade
Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.
Fixed in 4.4.0-1061.69
Upgrade
Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.
Fixed in 4.4.0-1063.68
Upgrade
Upgrade Linux kernel to a version that resolves this vulnerability.
Patch 83eaddab4378db256d00d295bda6ca997cd13a52

Event History

May 19, 2017

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Data Sourced

via Red Hat·02:25 PM

DescriptionSeverityAffected Software

Nov 6, 2017

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2017-9077?

CVE-2017-9077 is a vulnerability in the Linux kernel's tcp_v6_syn_recv_sock function that can lead to denial of service or other unspecified impacts due to mishandled inheritance.

What is the impact of CVE-2017-9077?

The impact of CVE-2017-9077 includes potential denial of service attacks that local users could exploit through crafted system calls.

How do I fix CVE-2017-9077?

To fix CVE-2017-9077, upgrade to kernel versions 5.10.223-1, 5.10.226-1, 6.1.123-1, or later versions.

Which Linux kernel versions are affected by CVE-2017-9077?

Linux kernel versions up to 4.4.71 and various versions between 3.2.89 and 4.11.4 are affected by CVE-2017-9077.

Is CVE-2017-9077 specific to any operating system?

Yes, CVE-2017-9077 primarily affects the Linux operating system, including distributions like Debian and Android.

CVE-2017-9077: High severity Linux Linux kernel vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What is CVE-2017-9077?

What is the impact of CVE-2017-9077?

How do I fix CVE-2017-9077?

Which Linux kernel versions are affected by CVE-2017-9077?

Is CVE-2017-9077 specific to any operating system?

Company

Resources

Contact